djust — Vulnerabilities & Security Advisories 14

All 14 CVE vulnerabilities found in djust, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-113731	djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool CWE-22	3.3	Low	2026-10-20
CVE-2026-61599	djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path CWE-470	8.8	High	2026-09-16
CVE-2026-61589	djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path CWE-348	6.3	Medium	2026-09-16
CVE-2026-61596	djust has broken object-level access control (IDOR) CWE-639	7.1	High	2026-09-16
CVE-2026-61588	djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client CWE-200	6.5	Medium	2026-09-16
CVE-2026-61594	djust has an authorization bypass on the WebSocket/SSE mount path CWE-306	9.1	Critical	2026-09-16
CVE-2026-61591	djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) CWE-345	8.1	High	2026-09-16
CVE-2026-61592	djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack) CWE-384	7.4	High	2026-09-16
CVE-2026-61597	djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags CWE-79	5.1	Medium	2026-09-16
CVE-2026-61593	djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session CWE-352	8.1	High	2026-09-16
CVE-2026-61595	djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data CWE-636	7.7	High	2026-09-16
CVE-2026-61598	Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler CWE-915	7.1	High	2026-09-16
CVE-2026-61590	djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG CWE-306	7.4	High	2026-09-16
CVE-2026-55571	djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls CWE-285	8.2	High	2026-08-25

All 14 known CVE vulnerabilities affecting djust with full Chinese analysis, references, and POCs where available.